/*
 * MalwareProfiler.c
 * Profiler to classify malware into generic categories
 * @author Gregoire JACOB (gregoire.jacob@orange-ftgroup.com)
 * @date 01/12/2008
 * @version 1.0
 * Central module, entry point of the analyzer
 */

#include ".\Includes\MalwareProfiler.h"

/**
 * main()
 * Open the script and launch a syntactic analysis
 */
int __cdecl main( int argc, char ** argv ){
	FILE * pf_BehavDB;
	FILE * pf_Profile;
	errno_t err;
	
	if(argc != 3){
		printf("[-] Incorrect parameters, correct usage is:\n");
		printf("      MalwareProfile [Behavior database] [Profile]\n");
		printf("      Behavior Database in XML format (specific DTD)\n");
	}else{
		//Loading the behavior database
		err = fopen_s(&pf_BehavDB,argv[1],"rb");
		if(err){
			printf("[-] Behavior database can not be opened\n");
			exit(0);
		}//if
		nbduplication = 0;
		duplicationbase = 
			(struct DUPLICATION *)calloc(MAX_NB_BEHAVIORS,sizeof(struct DUPLICATION));
		nbpropagation = 0;
		propagationbase = 
			(struct PROPAGATION *)calloc(MAX_NB_BEHAVIORS,sizeof(struct PROPAGATION));
		nbresidency = 0;
		residencybase = 
			(struct RESIDENCY *)calloc(MAX_NB_BEHAVIORS,sizeof(struct RESIDENCY));
		nboverinfection = 0;
		overinfectionbase = 
			(struct OVERINFECTION *)calloc(MAX_NB_BEHAVIORS,sizeof(struct OVERINFECTION));
		nbexecution = 0;
		executionbase = 
			(struct EXECUTIONPROXY *)calloc(MAX_NB_BEHAVIORS,sizeof(struct EXECUTIONPROXY));
		parseBehaviorDatabase(pf_BehavDB);

		//Opening profile
		err = fopen_s(&pf_Profile,argv[2],"wb");
		if(err){
			printf("[-] File to store the profile can not be opened\n");
			exit(0);
		}//if
		
		//Profiling malware
		writeXMLPreamble(pf_Profile);
		fprintf(pf_Profile,"<Profile>\n");
		checkVirusProfile(pf_Profile);
		checkEmailWormProfile(pf_Profile);
		checkP2PWormProfile(pf_Profile);
		checkIRCWormProfile(pf_Profile);
		checkNetWormProfile(pf_Profile);
		checkDriveWormProfile(pf_Profile);
		checkTrojanProfile(pf_Profile);
		fprintf(pf_Profile,"</Profile>\n");
	}
	return 0;
}
